zerophish / console
Register Sign in
URL THREAT INTELLIGENCE · v0.5.0 · OPERATIONAL

The full anatomy of a phishing site,
one URL at a time.

ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.

scan
100 scans / day · free · typical scan 2–4 s ·
try
Result scan 8c24b7b4
Scan another →
CACHED Showing previous scan from 74 d ago. Click Reanalyze to run a fresh scan.
SAFE · HIGH CONFIDENCE

No phishing signals detected

brand itch.io / Ferandonio scan id 8c24b7b4 duration 15.64s signals 2 failing / 25
Risk score 0.05
5 / 100 · Low risk
Tags
URL anatomy ferandonio.itch.io
https :// ferandonio . itch . io
flagged registered domain path protocol / query
Why this verdict 11 contributing signals · model gpt-5.4-nano
×
Credential collection form
Credential collection form detected on the page
↑ risk
×
Visual similarity to known brand
100% structural similarity to itch.io / Ferandonio
↑ risk
!
Email-auth posture (SPF/DMARC)
DMARC p=none (monitoring only) — domain can still be spoofed in mail
↑ risk
!
CAA issuer restriction
No CAA record — any certificate authority may issue a cert for this domain (phishing infra rarely sets CAA)
↑ risk
!
DNSSEC signing
Zone is not DNSSEC-signed — phishing domains are almost never signed
↑ risk
Brand typo-squat detected
No similar legitimate brand within edit-distance 2
↓ risk
Favicon impersonation
Favicon matches the registered owner
↓ risk
SSL certificate
Served over HTTPS · valid TLS certificate
↓ risk
Brand-in-subdomain attack
No known brand label in subdomain
↓ risk
Homoglyph attack
ASCII only · no mixed-script characters detected
↓ risk
Page language
Detected page language: English (en) — best-effort
↓ risk
enrichment used: dns network jarm asn
Indicators of compromise 6 · click any row to copy
URL hxxps://ferandonio[.]itch[.]io
Host ferandonio[.]itch[.]io
Registered domain itch[.]io
Brand itch.io / Ferandonio
Screenshot https://cdn.zerophish.ai/b8b12b23-5297-4204-8162-9e59df9e9de7.jpg
Scan ID 8c24b7b4-da4f-4870-8db8-4269928a4b73
Detection signals 2 fail · 3 warn · 6 pass
Brand typo-squat detected
No similar legitimate brand within edit-distance 2
critical
Domain age
Awaiting analysis
high
Threat intel blocklists
Awaiting analysis
critical
×
Credential collection form
Credential collection form detected on the page
high
×
Visual similarity to known brand
100% structural similarity to itch.io / Ferandonio
high
Favicon impersonation
Favicon matches the registered owner
medium
SSL certificate
Served over HTTPS · valid TLS certificate
low
DNS reputation
Awaiting analysis
medium
showing 8 of 25 ·
Captured page from scan
Captured page
screenshot · captured at scan live page render
Brand impersonation visual + DOM analysis
i
itch.io / Ferandonio
100%
Technical profile resolved at scan time
Host ferandonio.itch.io
Registered domain itch.io
Scheme https
Content length 56512 B
HTTP 200 · text/html
DMARC policy p=none
SPF policy strict
MX records present
Analyst summary AI-generated
Initial scan heuristic + LLM

What the page is presenting

This page is a profile page on itch.io for the user “Ferandonio” (URL: https://ferandonio.itch.io). It shows a content preview card (e.g., “Breathe With You Kaede”) and links back to itch.io.

Suspicious elements found (and why they are / aren’t phishing)

  • Age-gate / birthdate form (credential_form=true due to credential-like harvesting risk): The page contains a form requiring the visitor to enter a Date of Birth (“Please enter your birthdate to verify you are 18 or older” with form action="https://itch.io/content-warning" and fields birth_month, birth_day, birth_year). This is a user-input harvesting vector (personal data), but it is not a login/password or payment credential form.
  • Fake security warnings / urgency cues: None observed. The language is a standard adult-content gate (“You must be 18+ to view this content”).
  • Mismatched branding / domain tricks: No evidence of impersonating a third-party brand (no “PayPal”, “Microsoft”, etc.). The embedded forms and navigation stay within itch.io.
  • Suspicious redirects: The “Follow Ferandonio” link goes to https://itch.io/login?intent=follow_user&return_to=..., which is consistent with itch.io’s normal flow.

Brand identification and URL validation

  • Identified brand: itch.io (and the specific profile/subpage for Ferandonio).
  • Domain check: The site is hosted on itch.io subdomains (ferandonio.itch.io), which matches the identified platform. There is no lookalike domain or mismatch.

Conclusion

Verdict: legitimate (not phishing). The only interactive form is an 18+ content verification form posting to https://itch.io/content-warning, and the rest of the page content/links remain within itch.io. There are no classic phishing red flags like a fake login for another brand, credential harvesting (password fields), or urgent “account compromised” messages.